chore: production deploy

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -8,6 +8,8 @@ body:
       value: |
         Thanks for helping improve the Supabase CLI. Please include the exact command and output whenever possible so maintainers can reproduce the issue quickly.
 
+        Open this issue **before** starting work — a maintainer will add the `open-for-contribution` label once it is triaged and ready. Pull requests from external contributors that don't link an open, `open-for-contribution` issue are closed automatically. See [CONTRIBUTING.md](../blob/develop/CONTRIBUTING.md).
+
   - type: dropdown
     id: affected-area
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,8 @@
 blank_issues_enabled: false
 contact_links:
+  - name: 📖 Contribution workflow
+    url: https://github.com/supabase/cli/blob/develop/CONTRIBUTING.md
+    about: Read this before opening an issue or pull request — PRs must link a labeled, open issue.
   - name: Supabase support
     url: https://supabase.com/support
     about: Get help with your Supabase project, account, billing, or hosted services.

.github/ISSUE_TEMPLATE/docs.yml

@@ -3,6 +3,11 @@ description: Suggest an improvement to Supabase CLI documentation.
 labels:
   - 📘 Docs
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve the docs! Open this issue **before** starting work — a maintainer will add the `open-for-contribution` label once it is triaged and ready. Pull requests from external contributors that don't link an open, `open-for-contribution` issue are closed automatically. See [CONTRIBUTING.md](../blob/develop/CONTRIBUTING.md).
+
   - type: input
     id: link
     attributes:

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -3,6 +3,11 @@ description: Suggest an improvement or new capability for the Supabase CLI.
 labels:
   - ✨ Feature
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the suggestion! Open this issue **before** starting work — a maintainer will add the `open-for-contribution` label once it is triaged and ready. Pull requests from external contributors that don't link an open, `open-for-contribution` issue are closed automatically. See [CONTRIBUTING.md](../blob/develop/CONTRIBUTING.md).
+
   - type: checkboxes
     id: existing-issues
     attributes:

.github/MAINTAINERS.md

@@ -0,0 +1,58 @@
+# Maintainers guide
+
+Internal notes for maintaining the Supabase CLI contribution workflow. See
+[`CONTRIBUTING.md`](../CONTRIBUTING.md) for the contributor-facing version.
+
+## The `open-for-contribution` gate
+
+External pull requests are only accepted when they link to an **open** GitHub issue
+that carries the **`open-for-contribution`** label. This is enforced by the
+[`Contribution Gate`](./workflows/contribution-gate.yml) workflow, whose decision logic
+lives in [`scripts/contribution-gate.ts`](./scripts/contribution-gate.ts).
+
+The gate runs **reactively on each PR** so a non-conforming PR is closed right away, and
+can also be **swept across every open PR on demand** via the workflow's *Run workflow*
+button.
+
+A pull request is **auto-closed with an explanatory comment** when the author is external
+and any of these is true:
+
+- no issue is linked (via a closing keyword such as `Closes #123`, or the PR's
+  Development sidebar), or
+- the linked issue is closed, or
+- the linked issue is missing the `open-for-contribution` label.
+
+Authors whose `author_association` is `OWNER`, `MEMBER`, or `COLLABORATOR`, and bot
+accounts, are **exempt** — Supabase maintainers can keep working from Linear tickets that
+aren't public on GitHub.
+
+### Running the gate manually
+
+Use **Actions → Contribution Gate → Run workflow** to sweep all open PRs on demand — for
+example right after bulk-applying `open-for-contribution` labels, so the whole backlog is
+re-evaluated at once instead of waiting for each PR's next edit. Set the **`dry_run`**
+input to `true` first to log each PR's decision in the run output without commenting on or
+closing anything; run again with `dry_run` unchecked to apply the decisions.
+
+## Triage: applying the label (manual)
+
+During triage:
+
+1. Categorize the issue with one of `✨ Feature`, `🐛 Bug`, or `📘 Docs`. Issues opened
+   via the templates start with their category label already applied.
+2. When the issue is ready to be worked on, add the **`open-for-contribution`** label.
+
+The `open-for-contribution` label must exist as a repository label for this workflow to
+function; create it once from **Issues → Labels** if it is missing.
+
+Applying `open-for-contribution` is currently a **manual step** — do it on the GitHub
+issue directly (from the GitHub UI, or from the Linear-linked issue).
+
+## Deferred: automatic Linear → GitHub label sync
+
+We considered auto-applying `open-for-contribution` when a Linear issue moves out of
+Triage/Backlog (e.g. to Todo). Linear's native GitHub automations are one-directional
+(GitHub events update Linear status) and cannot push a GitHub label, so this would need an
+external bridge (a scheduled job polling the Linear API, a Zapier/Make zap, or a Linear
+webhook → relay). It is **out of scope for now** and tracked separately; until then, apply
+the label manually as above.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+<!--
+Before opening this PR, confirm the linked issue is open and carries the
+`open-for-contribution` label. PRs from external contributors that don't follow
+the workflow in CONTRIBUTING.md are closed automatically.
+@supabase members working from Linear tickets are exempt.
+-->
+
+## Summary
+
+<!-- What does this change and why? -->
+
+## Linked issue
+
+Closes #
+
+- [ ] The linked issue is **open** and carries the `open-for-contribution` label (or I'm a Supabase maintainer).
+
+## Checklist
+
+- [ ] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (e.g. `fix(cli): …`).
+- [ ] Tests added or updated for the change.
+- [ ] `pnpm check:all` and `pnpm test` pass for the workspace(s) I touched.